@ankurhalder/codebase-snapshot 4.0.0 → 4.0.2

package/dist/bin.js

@@ -6,145 +6,17 @@ import * as path12 from "path";
 import { parseArgs } from "util";
 
 // src/diff.ts
-import * as fs from "fs";
-import * as path from "path";
-function side(manifest) {
-  return {
-    generatedAt: manifest.generatedAt,
-    fingerprint: manifest.fingerprint,
-    fileCount: manifest.counts.totalFiles,
-    partsCount: manifest.counts.partsCount
-  };
-}
-function hashMap(manifest) {
-  const map = /* @__PURE__ */ new Map();
-  for (const file of manifest.files) {
-    if (file && typeof file.relativePath === "string") {
-      map.set(file.relativePath, file.hashSha256);
-    }
-  }
-  return map;
-}
-function manifestProblem(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return "not a JSON object";
-  const candidate = value;
-  if (!Array.isArray(candidate.files)) return 'no "files" array';
-  for (const entry of candidate.files) {
-    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
-      return 'a "files" entry is not an object';
-    }
-    if (typeof entry.relativePath !== "string") {
-      return 'a "files" entry has no "relativePath"';
-    }
-  }
-  const counts = candidate.counts;
-  if (!counts || typeof counts !== "object" || Array.isArray(counts)) {
-    return 'no "counts" object';
-  }
-  for (const key of ["totalFiles", "totalLines", "totalSizeBytes", "partsCount"]) {
-    if (typeof counts[key] !== "number") {
-      return `no numeric "counts.${key}"`;
-    }
-  }
-  if (typeof candidate.generatedAt !== "string") return 'no "generatedAt"';
-  if (typeof candidate.fingerprint !== "string") return 'no "fingerprint"';
-  return null;
-}
-function assertUsableManifest(value, label) {
-  const problem = manifestProblem(value);
-  if (problem) {
-    throw new Error(`The ${label} manifest is not a snapshot manifest this tool wrote: ${problem}.`);
-  }
-}
-function compareManifests(before, after) {
-  assertUsableManifest(before, "before");
-  assertUsableManifest(after, "after");
-  const left = hashMap(before);
-  const right = hashMap(after);
-  const added = [];
-  const removed = [];
-  const changed = [];
-  let unchanged = 0;
-  for (const [filePath, hash] of right) {
-    const previous = left.get(filePath);
-    if (previous === void 0) added.push(filePath);
-    else if (previous !== hash) changed.push(filePath);
-    else unchanged += 1;
-  }
-  for (const filePath of left.keys()) {
-    if (!right.has(filePath)) removed.push(filePath);
-  }
-  const sort = (values) => values.sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
-  return {
-    before: side(before),
-    after: side(after),
-    added: sort(added),
-    removed: sort(removed),
-    changed: sort(changed),
-    unchanged
-  };
-}
-function loadManifest(target) {
-  let isDirectory;
-  try {
-    isDirectory = fs.statSync(target).isDirectory();
-  } catch {
-    throw new Error(`No snapshot found at ${target}: the path does not exist.`);
-  }
-  const manifestPath = isDirectory ? path.join(target, "manifest.json") : target;
-  let raw;
-  try {
-    raw = fs.readFileSync(manifestPath, "utf8");
-  } catch {
-    throw new Error(`Could not read a manifest at ${manifestPath}.`);
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (err) {
-    throw new Error(`Could not parse ${manifestPath}: ${err.message}`);
-  }
-  const problem = manifestProblem(parsed);
-  if (problem) {
-    throw new Error(
-      `${manifestPath} is not a usable snapshot manifest: ${problem}. Point diff at a manifest.json written by \`generate\` (or at the directory that holds it).`
-    );
-  }
-  return parsed;
-}
-function renderDiffText(diff) {
-  const lines = [];
-  lines.push(`before  ${diff.before.generatedAt}  ${diff.before.fileCount} file(s), ${diff.before.partsCount} part(s)`);
-  lines.push(`after   ${diff.after.generatedAt}  ${diff.after.fileCount} file(s), ${diff.after.partsCount} part(s)`);
-  lines.push("");
-  lines.push(`  + ${diff.added.length} added`);
-  lines.push(`  - ${diff.removed.length} removed`);
-  lines.push(`  ~ ${diff.changed.length} changed`);
-  lines.push(`  = ${diff.unchanged} unchanged`);
-  const section = (title, values) => {
-    if (values.length === 0) return;
-    lines.push("", title);
-    for (const value of values.slice(0, 200)) lines.push(`  ${value}`);
-    if (values.length > 200) lines.push(`  ... and ${values.length - 200} more`);
-  };
-  section("added:", diff.added);
-  section("removed:", diff.removed);
-  section("changed:", diff.changed);
-  return lines.join("\n");
-}
-
-// src/explain.ts
-import * as fs6 from "fs";
-import * as path7 from "path";
-
-// src/config.ts
-import * as fs4 from "fs";
-import * as path4 from "path";
-import { pathToFileURL } from "url";
+import * as fs3 from "fs";
+import * as path3 from "path";
 
-// src/presets/context.ts
+// src/scanner/files.ts
+import * as childProcess from "child_process";
 import * as fs2 from "fs";
 import * as path2 from "path";
+
+// src/presets/context.ts
+import * as fs from "fs";
+import * as path from "path";
 var MANIFEST_FILES = [
   "package.json",
   "pyproject.toml",
@@ -160,11 +32,11 @@ var MANIFEST_FILES = [
 ];
 var MANIFEST_MAX_BYTES = 1e5;
 function readManifest(cwd, name) {
-  const full = path2.join(cwd, name);
+  const full = path.join(cwd, name);
   try {
-    const stats = fs2.statSync(full);
+    const stats = fs.statSync(full);
     if (!stats.isFile() || stats.size > MANIFEST_MAX_BYTES) return null;
-    return fs2.readFileSync(full, "utf8");
+    return fs.readFileSync(full, "utf8");
   } catch {
     return null;
   }
@@ -189,7 +61,7 @@ function buildPresetContext(cwd) {
   const files = /* @__PURE__ */ new Set();
   const dirs = /* @__PURE__ */ new Set();
   try {
-    for (const entry of fs2.readdirSync(cwd, { withFileTypes: true })) {
+    for (const entry of fs.readdirSync(cwd, { withFileTypes: true })) {
       if (entry.isDirectory()) dirs.add(entry.name);
       else if (entry.isFile()) files.add(entry.name);
     }
@@ -984,11 +856,6 @@ function detectPreset(cwd, forced) {
   return detectPresetFromContext(buildPresetContext(cwd), forced);
 }
 
-// src/scanner/files.ts
-import * as childProcess from "child_process";
-import * as fs3 from "fs";
-import * as path3 from "path";
-
 // src/security/patterns.ts
 var STRONG_CREDENTIAL_NAME = "(?:password|passwd|passphrase|pwd|api[_-]?key|api[_-]?secret|secret[_-]?access[_-]?key|secret[_-]?key|client[_-]?secret[_-]?key|client[_-]?secret|private[_-]?key|aws[_-]?secret[_-]?access[_-]?key|access[_-]?token|refresh[_-]?token|auth[_-]?token|session[_-]?token|secret|token)";
 var WEAK_CREDENTIAL_NAME = "(?:pass|id[_-]?token|credentials?)";
@@ -1389,14 +1256,14 @@ var PRESET_IGNORES = new Set(
 );
 function readLinkTarget(linkPath, fallback) {
   try {
-    return fs3.readlinkSync(linkPath);
+    return fs2.readlinkSync(linkPath);
   } catch {
     return fallback;
   }
 }
 function isInside(root, candidate) {
-  const relative5 = path3.relative(root, candidate);
-  return relative5 === "" || !relative5.startsWith(`..${path3.sep}`) && relative5 !== ".." && !path3.isAbsolute(relative5);
+  const relative5 = path2.relative(root, candidate);
+  return relative5 === "" || !relative5.startsWith(`..${path2.sep}`) && relative5 !== ".." && !path2.isAbsolute(relative5);
 }
 function getGitInfo(cwd, fallbackBranch = "main") {
   try {
@@ -1467,11 +1334,15 @@ function isSensitivePath(relativePath) {
   }
   return matchesSensitiveList(posixPath, base);
 }
-function findSecretInPath(relativePath) {
+function pathScanRules(extraRules) {
+  const fallback = extraRules ?? [];
+  return [...DEFAULT_SECRET_PATTERNS, ...fallback];
+}
+function findSecretInPath(relativePath, extraRules) {
   const posixPath = relativePath.replace(/\\/g, "/");
   const spans = [];
   const rules = [];
-  for (const { rule, pattern } of DEFAULT_SECRET_PATTERNS) {
+  for (const { rule, pattern } of pathScanRules(extraRules)) {
     const scan = new RegExp(pattern.source, `${pattern.flags.replace(/[gy]/g, "")}g`);
     let match;
     while ((match = scan.exec(posixPath)) !== null) {
@@ -1479,24 +1350,39 @@ function findSecretInPath(relativePath) {
         scan.lastIndex += 1;
         continue;
       }
-      spans.push({ start: match.index, end: match.index + match[0].length, rule });
+      spans.push({ start: match.index, end: match.index + match[0].length });
       if (!rules.includes(rule)) rules.push(rule);
     }
   }
   if (spans.length === 0) return null;
   spans.sort((a, b) => a.start - b.start || a.end - b.end);
+  const merged = [];
+  for (const span of spans) {
+    const last = merged[merged.length - 1];
+    if (last && span.start <= last.end) last.end = Math.max(last.end, span.end);
+    else merged.push({ start: span.start, end: span.end });
+  }
   let out = "";
   let cursor = 0;
-  for (const span of spans) {
-    if (span.end <= cursor) continue;
-    const start = Math.max(span.start, cursor);
-    out += posixPath.slice(cursor, start);
+  for (const span of merged) {
+    out += posixPath.slice(cursor, span.start);
     out += REDACTION_MARKER;
-    cursor = Math.min(span.end, posixPath.length);
+    cursor = span.end;
   }
   out += posixPath.slice(cursor);
   return { rules, masked: out };
 }
+function maskSkipPaths(records, extraRules) {
+  return records.map((record) => {
+    const hit = findSecretInPath(record.path, extraRules);
+    const detail = record.detail ? findSecretInPath(record.detail, extraRules) : null;
+    return {
+      ...record,
+      path: hit ? hit.masked : record.path,
+      ...detail ? { detail: detail.masked } : {}
+    };
+  });
+}
 function globToRegExp(glob) {
   const normalized = glob.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
   const anchored = normalized.startsWith("/");
@@ -1574,10 +1460,10 @@ function matchesExclude(relativePath, pattern) {
   return posixPath === cleaned || posixPath.startsWith(`${cleaned}/`) || posixPath.includes(`/${cleaned}/`) || posixPath.endsWith(`/${cleaned}`);
 }
 function readGitignoreMatcher(dir) {
-  const gitignorePath = path3.join(dir, ".gitignore");
+  const gitignorePath = path2.join(dir, ".gitignore");
   let raw;
   try {
-    raw = fs3.readFileSync(gitignorePath, "utf8");
+    raw = fs2.readFileSync(gitignorePath, "utf8");
   } catch {
     return () => false;
   }
@@ -1639,7 +1525,7 @@ function isToolOwnedDirName(name) {
 }
 function hasSnapshotMarker(target) {
   try {
-    return fs3.statSync(target).isDirectory() && fs3.existsSync(path3.join(target, ".codebase-snapshot"));
+    return fs2.statSync(target).isDirectory() && fs2.existsSync(path2.join(target, ".codebase-snapshot"));
   } catch {
     return false;
   }
@@ -1653,7 +1539,7 @@ function makeToolOwnedDecider(cwd) {
       if (depth === 1 && isToolOwnedDirName(prefix)) return true;
       let hasMarker = markers.get(prefix);
       if (hasMarker === void 0) {
-        hasMarker = fs3.existsSync(path3.join(cwd, prefix, ".codebase-snapshot"));
+        hasMarker = fs2.existsSync(path2.join(cwd, prefix, ".codebase-snapshot"));
         markers.set(prefix, hasMarker);
       }
       if (hasMarker) return true;
@@ -1667,7 +1553,7 @@ function makeLinkProbe() {
     let known = cache.get(absolutePath);
     if (known === void 0) {
       try {
-        known = fs3.lstatSync(absolutePath).isSymbolicLink();
+        known = fs2.lstatSync(absolutePath).isSymbolicLink();
       } catch {
         known = false;
       }
@@ -1680,7 +1566,7 @@ function dropLinkedDirectories(cwd, candidates, skipped) {
   const isLink = makeLinkProbe();
   let rootReal = cwd;
   try {
-    rootReal = fs3.realpathSync(cwd);
+    rootReal = fs2.realpathSync(cwd);
   } catch {
   }
   const reported = /* @__PURE__ */ new Set();
@@ -1690,7 +1576,7 @@ function dropLinkedDirectories(cwd, candidates, skipped) {
     let linkedDir = null;
     for (let depth = 1; depth <= parts.length; depth += 1) {
       const prefix = parts.slice(0, depth).join("/");
-      if (isLink(path3.join(cwd, prefix))) {
+      if (isLink(path2.join(cwd, prefix))) {
         linkedDir = prefix;
         break;
       }
@@ -1701,10 +1587,10 @@ function dropLinkedDirectories(cwd, candidates, skipped) {
     }
     if (reported.has(linkedDir)) continue;
     reported.add(linkedDir);
-    const absolute = path3.join(cwd, linkedDir);
+    const absolute = path2.join(cwd, linkedDir);
     let targetReal = absolute;
     try {
-      targetReal = fs3.realpathSync(absolute);
+      targetReal = fs2.realpathSync(absolute);
     } catch {
     }
     const target = readLinkTarget(absolute, targetReal);
@@ -1727,6 +1613,7 @@ function collectFiles(cwd, options = {}) {
   const includePatterns = options.includePatterns ?? [];
   const excludePatterns = options.excludePatterns ?? [];
   const includeSensitiveFiles = options.includeSensitiveFiles ?? false;
+  const pathRules = options.secretRules;
   const isToolOwned = makeToolOwnedDecider(cwd);
   let candidates;
   const skipped = [];
@@ -1762,7 +1649,7 @@ function collectFiles(cwd, options = {}) {
       }
     }
   } catch {
-    const walked = walkDirectory(cwd, cwd, /* @__PURE__ */ new Set(), true);
+    const walked = walkDirectory(cwd, cwd, rootRealFor(cwd), /* @__PURE__ */ new Set(), true);
     candidates = walked.files;
     skipped.push(...walked.skipped);
   }
@@ -1800,7 +1687,7 @@ function collectFiles(cwd, options = {}) {
       });
       return false;
     }
-    const secret = findSecretInPath(file);
+    const secret = findSecretInPath(file, pathRules);
     if (secret) {
       skipped.push({
         path: secret.masked,
@@ -1811,35 +1698,34 @@ function collectFiles(cwd, options = {}) {
     }
     return true;
   }).sort();
-  return { files, skipped };
+  return { files, skipped: maskSkipPaths(skipped, pathRules) };
 }
-function walkDirectory(dir, baseDir, visited, isRoot = false) {
-  const results = { files: [], skipped: [] };
-  let realDir;
-  try {
-    realDir = fs3.realpathSync(dir);
-  } catch {
-    realDir = dir;
-  }
-  if (visited.has(realDir)) return results;
-  visited.add(realDir);
-  let rootReal;
+function rootRealFor(root) {
   try {
-    rootReal = fs3.realpathSync(baseDir);
+    return fs2.realpathSync(root);
   } catch {
-    rootReal = baseDir;
+    return root;
   }
+}
+function walkDirectory(dir, baseDir, rootReal, visited, isRoot = false) {
+  const results = { files: [], skipped: [] };
+  if (visited.has(dir)) return results;
+  visited.add(dir);
   const ignoredByGitignore = isRoot ? readGitignoreMatcher(baseDir) : () => false;
   let entries;
   try {
-    entries = fs3.readdirSync(dir, { withFileTypes: true });
+    entries = fs2.readdirSync(dir, { withFileTypes: true });
   } catch {
-    results.skipped.push({ path: dir, reason: "read-error", detail: "directory unreadable" });
+    results.skipped.push({
+      path: path2.relative(baseDir, dir).replace(/\\/g, "/") || ".",
+      reason: "read-error",
+      detail: "directory unreadable"
+    });
     return results;
   }
   for (const entry of entries) {
-    const fullPath = path3.join(dir, entry.name);
-    const relPath = path3.relative(baseDir, fullPath).replace(/\\/g, "/");
+    const fullPath = path2.join(dir, entry.name);
+    const relPath = path2.relative(baseDir, fullPath).replace(/\\/g, "/");
     if (isToolOwnedDirName(entry.name)) continue;
     if (DEFAULT_IGNORED_DIRS.includes(entry.name)) {
       results.skipped.push({
@@ -1872,14 +1758,14 @@ function walkDirectory(dir, baseDir, visited, isRoot = false) {
     if (entry.isSymbolicLink()) {
       let targetReal;
       try {
-        targetReal = fs3.realpathSync(fullPath);
+        targetReal = fs2.realpathSync(fullPath);
       } catch {
         results.skipped.push({ path: relPath, reason: "read-error", detail: "broken symlink" });
         continue;
       }
       let stats;
       try {
-        stats = fs3.statSync(fullPath);
+        stats = fs2.statSync(fullPath);
       } catch {
         results.skipped.push({ path: relPath, reason: "read-error", detail: "unreadable symlink" });
         continue;
@@ -1913,7 +1799,7 @@ function walkDirectory(dir, baseDir, visited, isRoot = false) {
       isFile = true;
     }
     if (isDirectory) {
-      const nested = walkDirectory(fullPath, baseDir, visited);
+      const nested = walkDirectory(fullPath, baseDir, rootReal, visited);
       results.files.push(...nested.files);
       results.skipped.push(...nested.skipped);
     } else if (isFile) {
@@ -1923,7 +1809,141 @@ function walkDirectory(dir, baseDir, visited, isRoot = false) {
   return results;
 }
 
+// src/diff.ts
+function side(manifest) {
+  return {
+    generatedAt: manifest.generatedAt,
+    fingerprint: manifest.fingerprint,
+    fileCount: manifest.counts.totalFiles,
+    partsCount: manifest.counts.partsCount
+  };
+}
+function hashMap(manifest) {
+  const map = /* @__PURE__ */ new Map();
+  for (const file of manifest.files) {
+    if (file && typeof file.relativePath === "string") {
+      map.set(file.relativePath, file.hashSha256);
+    }
+  }
+  return map;
+}
+function manifestProblem(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return "not a JSON object";
+  const candidate = value;
+  if (!Array.isArray(candidate.files)) return 'no "files" array';
+  for (const entry of candidate.files) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+      return 'a "files" entry is not an object';
+    }
+    if (typeof entry.relativePath !== "string") {
+      return 'a "files" entry has no "relativePath"';
+    }
+  }
+  const counts = candidate.counts;
+  if (!counts || typeof counts !== "object" || Array.isArray(counts)) {
+    return 'no "counts" object';
+  }
+  for (const key of ["totalFiles", "totalLines", "totalSizeBytes", "partsCount"]) {
+    if (typeof counts[key] !== "number") {
+      return `no numeric "counts.${key}"`;
+    }
+  }
+  if (typeof candidate.generatedAt !== "string") return 'no "generatedAt"';
+  if (typeof candidate.fingerprint !== "string") return 'no "fingerprint"';
+  return null;
+}
+function assertUsableManifest(value, label) {
+  const problem = manifestProblem(value);
+  if (problem) {
+    throw new Error(`The ${label} manifest is not a snapshot manifest this tool wrote: ${problem}.`);
+  }
+}
+function compareManifests(before, after) {
+  assertUsableManifest(before, "before");
+  assertUsableManifest(after, "after");
+  const left = hashMap(before);
+  const right = hashMap(after);
+  const added = [];
+  const removed = [];
+  const changed = [];
+  let unchanged = 0;
+  for (const [filePath, hash] of right) {
+    const previous = left.get(filePath);
+    if (previous === void 0) added.push(filePath);
+    else if (previous !== hash) changed.push(filePath);
+    else unchanged += 1;
+  }
+  for (const filePath of left.keys()) {
+    if (!right.has(filePath)) removed.push(filePath);
+  }
+  const sort = (values) => values.sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+  const mask = (values) => values.map((value) => findSecretInPath(value)?.masked ?? value);
+  return {
+    before: side(before),
+    after: side(after),
+    added: mask(sort(added)),
+    removed: mask(sort(removed)),
+    changed: mask(sort(changed)),
+    unchanged
+  };
+}
+function loadManifest(target) {
+  let isDirectory;
+  try {
+    isDirectory = fs3.statSync(target).isDirectory();
+  } catch {
+    throw new Error(`No snapshot found at ${target}: the path does not exist.`);
+  }
+  const manifestPath = isDirectory ? path3.join(target, "manifest.json") : target;
+  let raw;
+  try {
+    raw = fs3.readFileSync(manifestPath, "utf8");
+  } catch {
+    throw new Error(`Could not read a manifest at ${manifestPath}.`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`Could not parse ${manifestPath}: ${err.message}`);
+  }
+  const problem = manifestProblem(parsed);
+  if (problem) {
+    throw new Error(
+      `${manifestPath} is not a usable snapshot manifest: ${problem}. Point diff at a manifest.json written by \`generate\` (or at the directory that holds it).`
+    );
+  }
+  return parsed;
+}
+function renderDiffText(diff) {
+  const lines = [];
+  lines.push(`before  ${diff.before.generatedAt}  ${diff.before.fileCount} file(s), ${diff.before.partsCount} part(s)`);
+  lines.push(`after   ${diff.after.generatedAt}  ${diff.after.fileCount} file(s), ${diff.after.partsCount} part(s)`);
+  lines.push("");
+  lines.push(`  + ${diff.added.length} added`);
+  lines.push(`  - ${diff.removed.length} removed`);
+  lines.push(`  ~ ${diff.changed.length} changed`);
+  lines.push(`  = ${diff.unchanged} unchanged`);
+  const section = (title, values) => {
+    if (values.length === 0) return;
+    lines.push("", title);
+    for (const value of values.slice(0, 200)) lines.push(`  ${value}`);
+    if (values.length > 200) lines.push(`  ... and ${values.length - 200} more`);
+  };
+  section("added:", diff.added);
+  section("removed:", diff.removed);
+  section("changed:", diff.changed);
+  return lines.join("\n");
+}
+
+// src/explain.ts
+import * as fs6 from "fs";
+import * as path7 from "path";
+
 // src/config.ts
+import * as fs4 from "fs";
+import * as path4 from "path";
+import { pathToFileURL } from "url";
 var CONFIG_FILENAMES = [
   "snapshot.config.ts",
   "snapshot.config.js",
@@ -2809,18 +2829,22 @@ function readManifest2(config) {
 function explainPath(config, target) {
   const relative5 = normalizeTarget(config.cwd, target);
   const absolute = path7.join(config.cwd, relative5);
+  const maskedPath2 = findSecretInPath(relative5, config.secretRules)?.masked ?? relative5;
   const result = {
-    path: relative5,
+    path: maskedPath2,
     exists: fs6.existsSync(absolute),
     included: false
   };
   const collection = collectFiles(config.cwd, {
     includePatterns: config.include,
     excludePatterns: [...config.excludePatterns, ...config.presetExclude],
-    includeSensitiveFiles: config.includeSensitiveFiles
+    includeSensitiveFiles: config.includeSensitiveFiles,
+    secretRules: config.secretRules
   });
   if (!collection.files.includes(relative5)) {
-    const record = collection.skipped.find((entry2) => entry2.path === relative5);
+    const record = collection.skipped.find(
+      (entry2) => entry2.path === relative5 || entry2.path === maskedPath2
+    );
     if (record) {
       result.reason = record.reason;
       result.detail = record.detail;
@@ -2857,7 +2881,7 @@ function explainPath(config, target) {
     result.secrets = findings.slice(0, 20).map((finding) => ({ rule: finding.rule, line: finding.line }));
   }
   const manifest = readManifest2(config);
-  const entry = manifest?.files.find((file) => file.relativePath === relative5);
+  const entry = Array.isArray(manifest?.files) ? manifest.files.find((file) => file.relativePath === relative5) : void 0;
   result.part = entry?.part ?? null;
   result.inclusionMode = entry?.inclusionMode;
   return result;
@@ -4446,7 +4470,8 @@ function summarizeMarkdown(content) {
 }
 
 // src/generator/audit.ts
-function generateAuditReport(manifest, secretFindings) {
+function generateAuditReport(manifest, secretFindings, secretRules) {
+  const mask = (value) => findSecretInPath(value, secretRules)?.masked ?? value;
   const lines = [
     "# Codebase Health & Security Audit",
     "",
@@ -4481,7 +4506,7 @@ function generateAuditReport(manifest, secretFindings) {
       "| :--- | :--- | :--- |"
     );
     for (const finding of secretFindings) {
-      lines.push(`| \`${finding.path ?? "unknown"}\` | ${finding.line} | \`${finding.rule}\` |`);
+      lines.push(`| \`${mask(finding.path ?? "unknown")}\` | ${finding.line} | \`${finding.rule}\` |`);
     }
     lines.push("", "### Matches by rule", "", "| Rule | Matches |", "| :--- | :--- |");
     for (const [rule, count] of Array.from(byRule.entries()).sort((a, b) => b[1] - a[1])) {
@@ -4503,7 +4528,7 @@ function generateAuditReport(manifest, secretFindings) {
     for (const file of largeFiles) {
       const sizeKb = (file.sizeBytes / 1024).toFixed(1);
       const status = file.isPreviewTruncated ? "Truncated Head/Tail" : "Full";
-      lines.push(`| \`${file.relativePath}\` | ${sizeKb} KB | ${file.lines} | ${status} |`);
+      lines.push(`| \`${mask(file.relativePath)}\` | ${sizeKb} KB | ${file.lines} | ${status} |`);
     }
     lines.push("");
   }
@@ -4545,7 +4570,7 @@ function generateAuditReport(manifest, secretFindings) {
       "| :--- | :--- | :--- |"
     );
     for (const skip of manifest.skipped) {
-      lines.push(`| \`${skip.path}\` | \`${skip.reason}\` | ${skip.detail ?? "-"} |`);
+      lines.push(`| \`${mask(skip.path)}\` | \`${skip.reason}\` | ${skip.detail ?? "-"} |`);
     }
     lines.push("");
   }
@@ -5044,6 +5069,9 @@ function generateProjectTree(filePaths) {
 import * as crypto2 from "crypto";
 import * as fs8 from "fs";
 import * as path9 from "path";
+function maskedPath(value, secretRules) {
+  return findSecretInPath(value, secretRules)?.masked ?? value;
+}
 function emptyDrift() {
   return {
     missingInSnapshot: [],
@@ -5114,15 +5142,20 @@ function validateSnapshot(configInput) {
   const skippedSet = new Set(
     manifest.skipped.filter((entry) => entry && typeof entry.path === "string").map((entry) => entry.path)
   );
+  const isSkippedOnDisk = (diskFile) => {
+    if (skippedSet.has(diskFile)) return true;
+    return skippedSet.has(maskedPath(diskFile, config.secretRules));
+  };
   const collection = collectFiles(config.cwd, {
     includePatterns: config.include,
     excludePatterns: [...config.excludePatterns, ...config.presetExclude],
-    includeSensitiveFiles: config.includeSensitiveFiles
+    includeSensitiveFiles: config.includeSensitiveFiles,
+    secretRules: config.secretRules
   });
   for (const diskFile of collection.files) {
     const snapshotHash = manifestFileMap.get(diskFile);
     if (!snapshotHash) {
-      if (skippedSet.has(diskFile) && !wouldNowBeIncluded(config.cwd, diskFile)) continue;
+      if (isSkippedOnDisk(diskFile) && !wouldNowBeIncluded(config.cwd, diskFile)) continue;
       drift.missingInSnapshot.push(diskFile);
       continue;
     }
@@ -5391,10 +5424,19 @@ function validateSnapshot(configInput) {
       `${drift.configMismatches.length} configuration mismatch(es) between the manifest and this run.`
     );
   }
+  const maskedDrift = {
+    ...drift,
+    missingInSnapshot: drift.missingInSnapshot.map((value) => maskedPath(value, config.secretRules)),
+    missingOnDisk: drift.missingOnDisk.map((value) => maskedPath(value, config.secretRules)),
+    hashMismatches: drift.hashMismatches.map((mismatch) => ({
+      ...mismatch,
+      path: maskedPath(mismatch.path, config.secretRules)
+    }))
+  };
   return {
     valid: errors.length === 0,
     manifestPresent: true,
-    drift,
+    drift: maskedDrift,
     errors,
     warnings
   };
@@ -5402,7 +5444,7 @@ function validateSnapshot(configInput) {
 
 // src/index.ts
 var GENERATOR_NAME = "@ankurhalder/codebase-snapshot";
-var GENERATOR_VERSION = "4.0.0";
+var GENERATOR_VERSION = "4.0.2";
 var SCHEMA_VERSION = "3.0.0";
 function sha256Hex2(input) {
   return crypto3.createHash("sha256").update(input).digest("hex");
@@ -5439,7 +5481,6 @@ function bump(counts, key) {
 }
 var RELATIVE_SPECIFIER = /^\.{1,2}\//;
 var IMPORT_CANDIDATE_SUFFIXES = [
-  "",
   ".ts",
   ".tsx",
   ".mts",
@@ -5453,23 +5494,59 @@ var IMPORT_CANDIDATE_SUFFIXES = [
   "/index.js",
   "/index.mjs"
 ];
-function resolveSpecifier(fromFile, specifier, knownFiles) {
+var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".ts",
+  ".tsx",
+  ".mts",
+  ".cts",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs"
+]);
+function buildImportResolver(files) {
+  const byPath = /* @__PURE__ */ new Map();
+  const byPathFolded = /* @__PURE__ */ new Map();
+  const byStem = /* @__PURE__ */ new Map();
+  const byStemFolded = /* @__PURE__ */ new Map();
+  const remember = (map, key, value) => {
+    if (!map.has(key)) map.set(key, value);
+  };
+  for (const file of files) {
+    const relativePath = file.relativePath;
+    remember(byPath, relativePath, relativePath);
+    remember(byPathFolded, relativePath.toLowerCase(), relativePath);
+    const extension = path10.posix.extname(relativePath);
+    if (!SOURCE_EXTENSIONS.has(extension)) continue;
+    const stem = relativePath.slice(0, -extension.length);
+    remember(byStem, stem, relativePath);
+    remember(byStemFolded, stem.toLowerCase(), relativePath);
+    if (path10.posix.basename(stem) === "index") {
+      const directory = path10.posix.dirname(stem);
+      remember(byStem, directory, relativePath);
+      remember(byStemFolded, directory.toLowerCase(), relativePath);
+    }
+  }
+  return { byPath, byPathFolded, byStem, byStemFolded };
+}
+function resolveSpecifier(fromFile, specifier, resolver) {
   if (!RELATIVE_SPECIFIER.test(specifier)) return null;
-  const baseDir = path10.posix.dirname(fromFile);
-  const joined = path10.posix.normalize(path10.posix.join(baseDir, specifier));
-  const candidate = joined.replace(/\.(?:js|mjs|cjs|jsx)$/, "");
+  const joined = path10.posix.normalize(
+    path10.posix.join(path10.posix.dirname(fromFile), specifier)
+  );
+  const exact = (key) => resolver.byPath.get(key) ?? resolver.byPathFolded.get(key.toLowerCase()) ?? null;
+  const direct = exact(joined);
+  if (direct) return direct;
   for (const suffix of IMPORT_CANDIDATE_SUFFIXES) {
-    const withSuffix = `${joined}${suffix}`;
-    if (knownFiles.has(withSuffix)) return withSuffix;
-  }
-  const extensionSwap = new RegExp(`${candidate}\\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs)$`);
-  for (const file of knownFiles) {
-    if (extensionSwap.test(file)) return file;
+    const hit = exact(`${joined}${suffix}`);
+    if (hit) return hit;
   }
-  return null;
+  const stem = joined.replace(/\.(?:js|mjs|cjs|jsx)$/, "");
+  const byStem = (key) => resolver.byStem.get(key) ?? resolver.byStemFolded.get(key.toLowerCase()) ?? null;
+  return byStem(joined) ?? byStem(stem);
 }
 function buildIndexes(files) {
-  const knownFiles = new Set(files.map((file) => file.relativePath));
+  const resolver = buildImportResolver(files);
   const importerCounts = /* @__PURE__ */ new Map();
   const byFile = files.filter((file) => isSourceSummary(file.summary)).map((file) => {
     const summary = file.summary;
@@ -5481,7 +5558,7 @@ function buildIndexes(files) {
   });
   for (const entry of byFile) {
     for (const specifier of entry.imports) {
-      const resolved = resolveSpecifier(entry.path, specifier, knownFiles);
+      const resolved = resolveSpecifier(entry.path, specifier, resolver);
       if (resolved) importerCounts.set(resolved, (importerCounts.get(resolved) ?? 0) + 1);
     }
   }
@@ -5572,15 +5649,22 @@ function resolveSafeOutputDirs(config) {
   return { outDir, tmpDir };
 }
 var PLACEHOLDER_ENTRIES = /* @__PURE__ */ new Set([".gitkeep", ".gitignore", ".DS_Store"]);
-var STAGING_ENTRIES = /* @__PURE__ */ new Set([
-  ".codebase-snapshot",
-  "manifest.json",
-  "README.md",
-  "parts",
-  "reports",
-  "full-codebase.json",
-  "full-codebase.md"
-]);
+var RUN_DIR_PREFIX = "run-";
+var STALE_RUN_MS = 60 * 60 * 1e3;
+function maskPathText(value, secretRules) {
+  return findSecretInPath(value, secretRules)?.masked ?? value;
+}
+function maskSkipRecords(records, secretRules) {
+  return maskSkipPaths(records, secretRules);
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code !== "ESRCH";
+  }
+}
 var OWNERSHIP_MARKER = ".codebase-snapshot";
 var SUPPORTED_MARKER_SCHEMAS = /* @__PURE__ */ new Set([SCHEMA_VERSION]);
 var SNAPSHOT_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -5610,6 +5694,7 @@ function markerPayload(dir, state, id, createdAt) {
     createdAt,
     state,
     id,
+    pid: process.pid,
     entries: listEntries(dir)
   };
   const manifestPath = path10.join(dir, "manifest.json");
@@ -5673,6 +5758,7 @@ function readOwnershipMarker(dir) {
       createdAt: typeof candidate.createdAt === "string" ? candidate.createdAt : "unknown",
       state: candidate.state,
       id: candidate.id,
+      pid: typeof candidate.pid === "number" ? candidate.pid : void 0,
       manifestSha256: typeof candidate.manifestSha256 === "string" ? candidate.manifestSha256 : void 0,
       entries: Array.isArray(candidate.entries) && candidate.entries.every((entry) => typeof entry === "string") ? candidate.entries : void 0
     },
@@ -5780,7 +5866,7 @@ function describeEntries(entries, limit = 5) {
   const shown = entries.slice(0, limit).join(", ");
   return entries.length > limit ? `${shown}, and ${entries.length - limit} more` : shown;
 }
-function assertReplaceable(target, label) {
+function assertReplaceable(target, label, secretRules) {
   if (!fs9.existsSync(target)) return;
   if (!fs9.statSync(target).isDirectory()) {
     throw new Error(
@@ -5789,34 +5875,89 @@ function assertReplaceable(target, label) {
   }
   const entries = fs9.readdirSync(target);
   if (entries.length === 0) return;
-  if (label === "outDir" && entries.every((name) => PLACEHOLDER_ENTRIES.has(name))) return;
-  const { marker: marker2, problem } = readOwnershipMarker(target);
-  if (label === "tmpDir") {
-    if (!marker2) {
-      throw new Error(
-        `Refusing to replace tmpDir ${target}: ${problem ?? "it does not carry this generator's marker"}. This generator only clears a staging directory it wrote. Point tmpDir at a new or empty directory, or remove ${target} yourself.`
-      );
-    }
-    const unexpected = entries.filter((name) => !STAGING_ENTRIES.has(name));
-    if (unexpected.length > 0) {
-      throw new Error(
-        `Refusing to replace tmpDir ${target}: it holds ${describeEntries(unexpected)}, which this generator did not write. Point tmpDir at a new or empty directory, or remove those files yourself.`
-      );
-    }
-    return;
-  }
+  if (entries.every((name) => PLACEHOLDER_ENTRIES.has(name))) return;
+  const { problem } = readOwnershipMarker(target);
   const verdict = assessSnapshotDirectory(target);
   if (verdict.owned) return;
+  const shownForeign = verdict.foreignEntries.map((name) => maskPathText(name, secretRules));
+  const shownEntries = entries.map((name) => maskPathText(name, secretRules));
   if (verdict.foreignEntries.length > 0) {
     throw new Error(
-      `Refusing to replace ${label} ${target}: it carries this generator's ownership marker, but these entries are not part of the snapshot it recorded: ${describeEntries(verdict.foreignEntries)}. Remove them yourself, or point ${label} at a new or empty directory.`
+      `Refusing to replace ${label} ${target}: it carries this generator's ownership marker, but these entries are not part of the snapshot it recorded: ${describeEntries(shownForeign)}. Remove them yourself, or point ${label} at a new or empty directory.`
     );
   }
   const reason = verdict.problem ?? problem ?? "it does not look like a snapshot this generator wrote";
   throw new Error(
-    `Refusing to replace ${label} ${target}: ${reason} (found ${describeEntries(entries)}). Remove the directory yourself, or point ${label} at a new or empty directory.`
+    `Refusing to replace ${label} ${target}: ${reason} (found ${describeEntries(shownEntries)}). Remove the directory yourself, or point ${label} at a new or empty directory.`
   );
 }
+function assertStagingRootUsable(tmpDir, secretRules) {
+  if (!fs9.existsSync(tmpDir)) return;
+  if (!fs9.statSync(tmpDir).isDirectory()) {
+    throw new Error(`Refusing to write into tmpDir ${tmpDir}: it exists but is not a directory.`);
+  }
+  const entries = fs9.readdirSync(tmpDir);
+  if (entries.length === 0) return;
+  const foreign = entries.filter((name) => {
+    const full = path10.join(tmpDir, name);
+    if (!name.startsWith(RUN_DIR_PREFIX)) return true;
+    let stats;
+    try {
+      stats = fs9.statSync(full);
+    } catch {
+      return true;
+    }
+    if (!stats.isDirectory()) return true;
+    const { marker: marker2 } = readOwnershipMarker(full);
+    if (marker2) return false;
+    try {
+      return fs9.readdirSync(full).length > 0;
+    } catch {
+      return true;
+    }
+  });
+  if (foreign.length > 0) {
+    const shown = describeEntries(foreign.map((name) => maskPathText(name, secretRules)));
+    throw new Error(
+      `Refusing to replace tmpDir ${tmpDir}: it holds ${shown}, which this generator did not write. Point tmpDir at a new or empty directory, or remove those files yourself.`
+    );
+  }
+}
+function cleanStaleRunDirs(tmpDir) {
+  let entries;
+  try {
+    entries = fs9.readdirSync(tmpDir);
+  } catch {
+    return;
+  }
+  for (const name of entries) {
+    if (!name.startsWith(RUN_DIR_PREFIX)) continue;
+    const full = path10.join(tmpDir, name);
+    const { marker: marker2 } = readOwnershipMarker(full);
+    if (marker2) {
+      const created = Date.parse(marker2.createdAt);
+      const aged = !Number.isFinite(created) || Date.now() - created > STALE_RUN_MS;
+      const abandoned = typeof marker2.pid === "number" && !isProcessAlive(marker2.pid);
+      if (aged || abandoned) {
+        try {
+          fs9.rmSync(full, { recursive: true, force: true });
+        } catch {
+        }
+      }
+      continue;
+    }
+    try {
+      if (fs9.readdirSync(full).length === 0) fs9.rmSync(full, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
+function removeIfEmpty(dir) {
+  try {
+    if (fs9.readdirSync(dir).length === 0) fs9.rmSync(dir, { recursive: true, force: true });
+  } catch {
+  }
+}
 function ensureParentDirectory(target, label) {
   const parent = path10.dirname(target);
   if (fs9.existsSync(parent) && !fs9.statSync(parent).isDirectory()) {
@@ -5832,14 +5973,12 @@ function ensureParentDirectory(target, label) {
     );
   }
 }
-function acquireRunLock(outDir) {
-  const lockPath = path10.join(
-    os.tmpdir(),
-    `codebase-snapshot-${sha256Hex2(outDir).slice(0, 16)}.lock`
-  );
+function acquireRunLock(stagingRoot) {
+  const key = lockKeyFor(stagingRoot);
+  const lockPath = path10.join(os.tmpdir(), `codebase-snapshot-${key}.lock`);
   const payload = `${JSON.stringify({
     pid: process.pid,
-    outDir,
+    stagingRoot,
     startedAt: (/* @__PURE__ */ new Date()).toISOString()
   })}
 `;
@@ -5864,11 +6003,20 @@ function acquireRunLock(outDir) {
         continue;
       }
       throw new Error(
-        `Another generate run is already writing ${outDir}. Wait for it to finish, or delete ${lockPath} if no other run is active.`
+        `Another generate run is already using the staging directory ${stagingRoot}. Wait for it to finish, or delete ${lockPath} if no other run is active.`
       );
     }
   }
-  throw new Error(`Could not acquire the generate lock for ${outDir}.`);
+  throw new Error(`Could not acquire the generate lock for ${stagingRoot}.`);
+}
+function lockKeyFor(stagingRoot) {
+  let key = stagingRoot;
+  try {
+    key = fs9.realpathSync(stagingRoot);
+  } catch {
+  }
+  if (process.platform === "win32" || process.platform === "darwin") key = key.toLowerCase();
+  return sha256Hex2(key).slice(0, 16);
 }
 function lockOwnerIsGone(lockPath) {
   let raw;
@@ -5904,18 +6052,32 @@ function writeManifestAtomically(manifestPath, manifest) {
     throw err;
   }
 }
-function swapIntoPlace(tmpDir, outDir) {
+function swapIntoPlace(stagingDir, outDir) {
   ensureParentDirectory(outDir, "outDir");
+  const deadline = Date.now() + 3e3;
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      swapOnce(stagingDir, outDir);
+      return;
+    } catch (err) {
+      const code = err.code;
+      const racy = code === "ENOENT" || code === "ENOTEMPTY" || code === "EEXIST" || code === "EPERM";
+      if (!racy || attempt >= 10 || Date.now() > deadline) throw err;
+      sleepSync(50);
+    }
+  }
+}
+function swapOnce(stagingDir, outDir) {
   const backupDir = `${outDir}.backup-${process.pid}-${Date.now()}`;
   const hadPrevious = fs9.existsSync(outDir);
   if (hadPrevious) fs9.renameSync(outDir, backupDir);
   try {
     try {
-      fs9.renameSync(tmpDir, outDir);
+      fs9.renameSync(stagingDir, outDir);
     } catch (err) {
       if (err.code === "EXDEV") {
-        fs9.cpSync(tmpDir, outDir, { recursive: true });
-        fs9.rmSync(tmpDir, { recursive: true, force: true });
+        fs9.cpSync(stagingDir, outDir, { recursive: true });
+        fs9.rmSync(stagingDir, { recursive: true, force: true });
       } else {
         throw err;
       }
@@ -5929,6 +6091,10 @@ function swapIntoPlace(tmpDir, outDir) {
     throw err;
   }
 }
+function sleepSync(milliseconds) {
+  const buffer = new Int32Array(new SharedArrayBuffer(4));
+  Atomics.wait(buffer, 0, 0, milliseconds);
+}
 function artifactWarnings(artifacts) {
   const messages = [];
   if (!artifacts.manifest) {
@@ -5991,11 +6157,12 @@ function generateSnapshot(configInput, options) {
   const collection = collectFiles(config.cwd, {
     includePatterns: config.include,
     excludePatterns: [...config.excludePatterns, ...config.presetExclude],
-    includeSensitiveFiles: config.includeSensitiveFiles
+    includeSensitiveFiles: config.includeSensitiveFiles,
+    secretRules: config.secretRules
   });
   const files = [];
   const monolithBodies = /* @__PURE__ */ new Map();
-  const skipped = [...collection.skipped];
+  const skipped = maskSkipRecords([...collection.skipped], config.secretRules);
   const secretFindings = [];
   const warnings = [];
   const layerCounts = {};
@@ -6069,12 +6236,12 @@ function generateSnapshot(configInput, options) {
       summaryQuality = outcome?.quality;
       if (isSourceSummary(summary) && summary.parseErrors) {
         warnings.push(
-          `Parse errors in ${relativePath} (${summary.parseErrors}); its summary is incomplete.`
+          `Parse errors in ${maskPathText(relativePath, config.secretRules)} (${summary.parseErrors}); its summary is incomplete.`
         );
       }
     } catch (err) {
       warnings.push(
-        `Summary skipped for ${relativePath}: ${err.message}`.replace(/\s+/g, " ")
+        `Summary skipped for ${maskPathText(relativePath, config.secretRules)}: ${err.message}`.replace(/\s+/g, " ")
       );
     }
     files.push({
@@ -6118,6 +6285,7 @@ function generateSnapshot(configInput, options) {
   const truncatedPreviewCount = files.filter((file) => file.isPreviewTruncated).length;
   const validationErrors = verifyInMemory(files, parts, maxEffectiveBudget);
   const totalContentBytes = files.reduce((total, file) => total + file.includedBytes, 0);
+  const maskName = (value) => maskPathText(value, config.secretRules);
   const manifest = {
     schemaVersion: SCHEMA_VERSION,
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -6138,13 +6306,13 @@ function generateSnapshot(configInput, options) {
       includeMonolith: config.includeMonolith,
       includeSensitiveFiles: config.includeSensitiveFiles,
       artifacts: { ...config.artifacts },
-      include: [...config.include],
+      include: [...config.include].map(maskName),
       preset: config.preset,
       layersMode: config.layersMode,
       budgets: { default: config.budgets.default, byLayer: { ...config.budgets.byLayer } },
-      excludePatterns: [...config.excludePatterns],
-      layers: config.layers.map((layer2) => layer2.name),
-      kinds: config.kinds.map((kind) => kind.kind)
+      excludePatterns: [...config.excludePatterns].map(maskName),
+      layers: config.layers.map((layer2) => maskName(layer2.name)),
+      kinds: config.kinds.map((kind) => maskName(kind.kind))
     },
     counts: {
       totalFiles: files.length,
@@ -6183,12 +6351,12 @@ function generateSnapshot(configInput, options) {
       const { content: _content, ...rest } = file;
       return rest;
     }),
-    skipped,
+    skipped: maskSkipRecords(skipped, config.secretRules),
     warnings
   };
   manifest.warnings = [
     ...warnings,
-    ...secretFindings.map((finding) => `${finding.rule} at ${finding.path ?? "unknown"}:${finding.line}`)
+    ...secretFindings.map((finding) => `${finding.rule} at ${maskPathText(finding.path ?? "unknown", config.secretRules)}:${finding.line}`)
   ];
   manifest.totals.warningCount = manifest.warnings.length;
   let monolithJson = null;
@@ -6234,31 +6402,33 @@ function generateSnapshot(configInput, options) {
   manifest.totals.warningCount = manifest.warnings.length;
   const { outDir, tmpDir } = resolveSafeOutputDirs(config);
   const { artifacts } = config;
-  assertReplaceable(tmpDir, "tmpDir");
-  assertReplaceable(outDir, "outDir");
+  assertReplaceable(outDir, "outDir", config.secretRules);
+  assertStagingRootUsable(tmpDir, config.secretRules);
   if (dryRun) {
     runAfterGenerate(config, manifest);
     return manifest;
   }
-  const releaseLock = acquireRunLock(outDir);
-  let stagingStarted = false;
+  const releaseLock = acquireRunLock(tmpDir);
+  let stagingDir = null;
   try {
     ensureParentDirectory(outDir, "outDir");
-    fs9.rmSync(tmpDir, { recursive: true, force: true });
     fs9.mkdirSync(tmpDir, { recursive: true });
-    stagingStarted = true;
+    cleanStaleRunDirs(tmpDir);
     const snapshotId = crypto3.randomUUID();
     const createdAt = (/* @__PURE__ */ new Date()).toISOString();
-    writeOwnershipMarker(tmpDir, {
+    stagingDir = path10.join(tmpDir, `${RUN_DIR_PREFIX}${process.pid}-${snapshotId.slice(0, 8)}`);
+    fs9.mkdirSync(stagingDir);
+    writeOwnershipMarker(stagingDir, {
       generator: GENERATOR_NAME,
       version: GENERATOR_VERSION,
       schemaVersion: SCHEMA_VERSION,
       createdAt,
       state: "staging",
-      id: snapshotId
+      id: snapshotId,
+      pid: process.pid
     });
-    const partsDir = path10.join(tmpDir, "parts");
-    const reportsDir = path10.join(tmpDir, "reports");
+    const partsDir = path10.join(stagingDir, "parts");
+    const reportsDir = path10.join(stagingDir, "reports");
     if (artifacts.parts) fs9.mkdirSync(partsDir, { recursive: true });
     if (artifacts.navigation || artifacts.projectTree || artifacts.audit) {
       fs9.mkdirSync(reportsDir, { recursive: true });
@@ -6278,25 +6448,25 @@ function generateSnapshot(configInput, options) {
     if (artifacts.audit) {
       fs9.writeFileSync(
         path10.join(reportsDir, "audit.md"),
-        generateAuditReport(manifest, secretFindings),
+        generateAuditReport(manifest, secretFindings, config.secretRules),
         "utf8"
       );
     }
     if (artifacts.readme) {
-      fs9.writeFileSync(path10.join(tmpDir, "README.md"), generateReadme(manifest), "utf8");
+      fs9.writeFileSync(path10.join(stagingDir, "README.md"), generateReadme(manifest), "utf8");
     }
     if (artifacts.manifest) {
-      fs9.writeFileSync(path10.join(tmpDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf8");
+      fs9.writeFileSync(path10.join(stagingDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf8");
     }
     if (monolithJson !== null) {
-      fs9.writeFileSync(path10.join(tmpDir, "full-codebase.json"), monolithJson, "utf8");
+      fs9.writeFileSync(path10.join(stagingDir, "full-codebase.json"), monolithJson, "utf8");
     }
     if (monolithMarkdown !== null) {
-      fs9.writeFileSync(path10.join(tmpDir, "full-codebase.md"), monolithMarkdown, "utf8");
+      fs9.writeFileSync(path10.join(stagingDir, "full-codebase.md"), monolithMarkdown, "utf8");
     }
-    writeOwnershipMarker(tmpDir, markerPayload(tmpDir, "complete", snapshotId, createdAt));
-    swapIntoPlace(tmpDir, outDir);
-    stagingStarted = false;
+    writeOwnershipMarker(stagingDir, markerPayload(stagingDir, "complete", snapshotId, createdAt));
+    swapIntoPlace(stagingDir, outDir);
+    stagingDir = null;
     const warningsBeforeHook = manifest.warnings.length;
     runAfterGenerate(config, manifest);
     if (artifacts.manifest && manifest.warnings.length !== warningsBeforeHook) {
@@ -6305,14 +6475,15 @@ function generateSnapshot(configInput, options) {
     writeOwnershipMarker(outDir, markerPayload(outDir, "complete", snapshotId, createdAt));
     return manifest;
   } catch (err) {
-    if (stagingStarted) {
+    if (stagingDir !== null) {
       try {
-        fs9.rmSync(tmpDir, { recursive: true, force: true });
+        fs9.rmSync(stagingDir, { recursive: true, force: true });
       } catch {
       }
     }
     throw err;
   } finally {
+    removeIfEmpty(tmpDir);
     releaseLock();
   }
 }
@@ -6797,8 +6968,8 @@ function buildAgentContract() {
         "snapshot.config.mjs",
         "snapshot.config.cjs",
         "snapshot.config.json",
-        ".snapshotrc",
         ".snapshotrc.json",
+        ".snapshotrc",
         'package.json \u2192 "snapshot" key'
       ],
       settings: [
@@ -7601,8 +7772,7 @@ ${USAGE}
       warn(`\u274C ${manifestPath} is not a snapshot manifest: ${shapeError}`);
       return 1;
     }
-    const validation = validateSnapshot(resolved);
-    emit(invocation.format, { manifest, validation }, () => {
+    emit(invocation.format, { manifest, validation: null }, () => {
       info(`
 \u{1F4CA} Codebase Snapshot Report (${resolved.cwd})`);
       info(`   - Generated at:   ${manifest.generatedAt}`);
@@ -7614,14 +7784,14 @@ ${USAGE}
         `   - Total size:     ${(manifest.counts.totalSizeBytes / (1024 * 1024)).toFixed(2)} MB`
       );
       info(`   - Total parts:    ${manifest.counts.partsCount}`);
-      info(`   - Integrity:      ${validation.valid ? "\u2705 Clean (no drift)" : "\u274C Drift detected"}`);
+      info("   - Integrity:      not checked (run `codebase-snapshot validate`)");
       info(`   - Warnings:       ${manifest.warnings?.length ?? 0}`);
       info("\n   Layers:");
       for (const [layer2, count] of Object.entries(manifest.layers)) {
         info(`     - ${layer2.padEnd(16)}: ${count} files`);
       }
     });
-    return validation.valid ? 0 : 1;
+    return 0;
   }
   if (invocation.command === "explain") {
     const result = explainPath(resolved, invocation.args[0]);
@@ -7740,6 +7910,8 @@ async function runWatchLoop(invocation, resolved) {
     (segment) => segment === outName || segment === tmpName || segment.startsWith(`${outName}.backup-`) || VCS_SEGMENTS.has(segment)
   );
   let running = false;
+  let quietUntil = 0;
+  const QUIET_MS = 1500;
   const regenerate = async () => {
     if (running) return;
     running = true;
@@ -7777,6 +7949,7 @@ async function runWatchLoop(invocation, resolved) {
     } catch (err) {
       warn(`\u274C ${err.message}`);
     } finally {
+      quietUntil = performance.now() + QUIET_MS;
       running = false;
     }
   };
@@ -7784,6 +7957,7 @@ async function runWatchLoop(invocation, resolved) {
   void regenerate();
   let timer = null;
   const watcher = fs11.watch(resolved.cwd, { recursive: true }, (_event, filename) => {
+    if (performance.now() < quietUntil) return;
     if (filename) {
       const changed = path12.resolve(resolved.cwd, filename.toString());
       if (isGenerated(changed)) return;